Talos has recently started to collect and gather intelligence around phone numbers within emails as an additional indicator of compromise (IOC). In this blog, we discuss new insights into in-the-wild phone number reuse in scam emails.
The malicious emails claim to contain a conduct report and lure victims to a Microsoft phishing website that leverages AitM. The post Microsoft Warns of Sophisticated Phishing Campaign Targeting US Organizations appeared first on SecurityWeek .
Still under development, Bluekit provides users with automated domain registration and an AI Assistant. The post New Bluekit Phishing Kit Features AI Assistant appeared first on SecurityWeek .
Bad actors exploited Kuse, a legitimate AI-based workplace application, to conduct a phishing campaign. Attackers leveraged a Vendor Email Compromise (VEC) to send malicious emails from a trusted vendor's compromised mailbox, establishing initial trust. The attack utilized Kuse's file-sharing features to host a fake blurred document with a Markdown file extension (.md) under the legitimate domain app[.]kuse[.]ai. Victims were presented with a fabricated document preview containing Spanish text prompting them to click a link. This redirected users to a fraudulent Microsoft login page designed to harvest credentials. The attack combined multiple social engineering techniques including domain trust exploitation, unusual file extensions to evade detection, and vendor relationship abuse to bypass security controls and user scrutiny.
Phishing-to-RMM attacks exploit phishing techniques to gain unauthorized access to Remote Monitoring and Management (RMM) tools, creating a blind spot in business security. This threat highlights the risk of attackers leveraging phishing to compromise remote access systems, which are critical for IT management. The information is sourced from a Reddit Malware discussion with minimal technical details and no confirmed exploits in the wild. No specific affected software versions or patches are identified. The severity is assessed as medium based on the potential impact of unauthorized remote access.
Since mid-February 2026, German federal prosecutors have been investigating a phishing campaign targeting Signal accounts of high-ranking officials, including government ministers, military personnel, and journalists. The attackers impersonated a Signal security chatbot to trick victims into linking their accounts to external devices, enabling access to past and ongoing conversations and stored data. Approximately 300 Signal accounts were compromised. German authorities suspect Russian state actors may be behind the campaign, though no official attribution has been made. Similar warnings have been issued by Dutch intelligence regarding Russian state hackers targeting Signal and WhatsApp accounts. The campaign is considered espionage-related and has drawn significant attention from European security agencies.
New waves of attacks on Apple users are leading to stolen cryptocurrency: fake crypto wallets in the App Store, trojanized legitimate macOS crypto apps, and other threats. Here’s how to stay protected.
Frontier AI models represent a new generation of advanced large-scale AI capable of autonomously identifying software vulnerabilities, chaining exploits, and adapting to defenses at machine speed. This accelerates the discovery and weaponization of vulnerabilities, compressing attack windows from days to minutes. Open-source software is particularly at risk due to its transparent codebase, enabling large-scale supply chain compromises. Vulnerability chaining allows attackers to combine multiple lower-severity issues into critical exploit paths, bypassing traditional security filters. Current human-speed security operations are insufficient to keep pace with autonomous AI-driven attacks, necessitating AI-driven detection and response. Frontier AI also enhances reconnaissance and social engineering by generating highly personalized phishing attacks. Defenses must shift to integrating AI into development and security processes, adopting adaptive identity and access management, and prioritizing vulnerability triage based on attacker reachability and AI exploitability. Palo Alto Networks offers services to help organizations assess and prepare for these emerging risks.
How to identify tax-related phishing and fraud: fake portals, bogus crypto wallet verifications, and malicious files. We break down the steps you need to take to protect both your money and your data.
A sophisticated ClickFix campaign was detected in mid-March 2026, beginning with a malicious webpage impersonating Booking.com's visual identity with a fake CAPTCHA. The attack leverages social engineering to trick victims into executing a PowerShell command that downloads and runs a script directly in memory. The JavaScript code automatically copies malicious commands to the clipboard and intercepts copy events. Once executed, the PowerShell dropper performs system fingerprinting, downloads a ZIP payload from a remote server, deploys it to user directories, establishes persistence through registry keys and scheduled tasks, and executes the final payload. The campaign demonstrates well-structured code with fallback mechanisms and real-time telemetry via Telegram, suggesting the use of a ready-to-use attack kit.
&#;x26;#;x5b;This is a Guest Diary by L. Carty, an ISC intern as part of the SANS.edu Bachelor&#;x26;#;39;s Degree in Applied Cybersecurity (BACS) program &#;x26;#;x5b;1].]
A senior member of the cybercrime group 'Scattered Spider,' Tyler Robert Buchanan, pleaded guilty to wire fraud conspiracy and aggravated identity theft. He admitted involvement in text-message phishing attacks during summer 2022 that compromised at least a dozen major technology companies. These attacks resulted in the theft of tens of millions of dollars in cryptocurrency from investors. The threat involves social engineering via phishing rather than a software vulnerability. There is no indication of a patch or technical remediation since this is a criminal activity case. The severity is assessed as low given the nature of the threat and lack of ongoing exploit details.
Threat actors are reusing Tycoon 2FA tools across other phishing kits following the platform’s disruption. The post Tycoon 2FA Loses Phishing Kit Crown Amid Surge in Attacks appeared first on SecurityWeek .
I spotted an interesting piece of JavaScript code that was delivered via a phishing email in a RAR archive. The file was called “cbmjlzan.JS” (SHA256:a8ba9ba93b4509a86e3d7dd40fd0652c2743e32277760c5f7942b788b74c5285) and is only identified as malicious by 15 AV's on VirusTotal[1].
A BTS comeback and world-tour announcement has resulted in a new wave of scam campaigns. Kaspersky experts have discovered fraudulent websites that sell fake BTS tickets to fans all around the world. We explain what those fake pages look like, and how you can avoid getting scammed.
In 2025, the FBI reported receiving over 1 million complaints related to malicious cyber activities, with total losses nearing $21 billion. The most financially damaging scams involved investment fraud, business email compromise (BEC), and tech support scams. This data highlights the significant financial impact of phishing and related cybercrime activities during that year.
Telemedicine is a huge time-saver, but a leak of your medical records carries serious risks. We’re breaking down the threats, and sharing simple tips to keep your health data private.
In one of his recent diaries, Johannes discussed how open redirects are actively being sought out by threat actors[1], which made me wonder about how commonly these mechanisms are actually misused…
